Vesta Nginx STRICT SSL ips4 template.
This is not a guide on how to use the template, just rather a general template for more experienced users.
This template is also based on community recommended nginx patterns and can be tweaked to your liking.
nginx php-fpm templates are stored under /usr/local/vesta/data/templates/nginx/php-fpm/
Add the following files in that directory.
ips4.tpl
server {
listen %ip%:%web_port%;
server_name %domain_idn% %alias_idn%;
root %docroot%;
include %home%/%user%/conf/web/nginx.%domain%.conf*;
return 301 https://%domain_idn%$request_uri;
}
ips4.stpl
server {
listen %ip%:%web_ssl_port%;
server_name %domain_idn% %alias_idn%;
root %sdocroot%;
index index.php
access_log /var/log/nginx/domains/%domain%.log combined;
access_log /var/log/nginx/domains/%domain%.bytes bytes;
error_log /var/log/nginx/domains/%domain%.error.log error;
ssl on;
ssl_certificate %ssl_pem%;
ssl_certificate_key %ssl_key%;
include %home%/%user%/conf/web/snginx.%domain%.conf*;
if ($host = '%alias_idn%' ) {
return 301 https://%domain_idn%$request_uri;
}
client_max_body_size 100M;
# Friendly URL "rewrite" rules
location / {
try_files $uri $uri/ @ips;
}
# Friendly URL "rewrite" rules
location /api/ {
try_files $uri $uri/ @ips_api;
}
include /etc/nginx/conf.d/ips/protect_upload_directories;
include /etc/nginx/conf.d/deny_dotfiles;
location ~* ^.+\.(?:jpg|jpeg|gif|css|png|js|ico|xml|htm|swf|cur)$ {
try_files $uri @ips404
access_log off;
expires 2w;
}
# Lock down access to the AdminCP
location ~ ^/admin/.+\.php$ {
#allow 127.0.0.1;
#deny all;
#auth_basic "This page is restricted to administrators";
#auth_basic_user_file $document_root/admin/.htpasswd;
try_files $uri @ips404;
include /etc/nginx/conf.d/php_fastcgi_params;
fastcgi_pass %backend_lsnr%;
}
# Execute the requested PHP script if it exists, otherwise pass off to IPS
location ~ \.php$ {
try_files $uri @ips;
include /etc/nginx/conf.d/php_fastcgi_params;
fastcgi_pass %backend_lsnr%;
fastcgi_buffers 38 4k;
fastcgi_buffer_size 16k;
}
# Pass off not found errors to IPS' 404 handler
location @ips404 {
include /etc/nginx/conf.d/php_fastcgi_params;
fastcgi_pass %backend_lsnr%;
fastcgi_param SCRIPT_FILENAME $document_root/404error.php;
fastcgi_param SCRIPT_NAME 404error.php;
}
# Send rewritten requests directly to IPS
location @ips {
include /etc/nginx/conf.d/php_fastcgi_params;
fastcgi_pass %backend_lsnr%;
fastcgi_param SCRIPT_FILENAME $document_root/index.php;
fastcgi_param SCRIPT_NAME /index.php;
fastcgi_buffers 38 4k;
fastcgi_buffer_size 16k;
}
# Send rewritten requests directly to IPS API
location @ips_api {
include /etc/nginx/conf.d/php_fastcgi_params;
fastcgi_pass %backend_lsnr%;
fastcgi_param SCRIPT_FILENAME $document_root/api/index.php;
fastcgi_buffers 38 4k;
fastcgi_buffer_size 16k;
}
location ~* "/\.(htaccess|htpasswd)$" {
deny all;
return 404;
}
}
